# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1971

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 1972

---

## [Elaspic mapper-size not working](https://discuss.elastic.co/t/elaspic-mapper-size-not-working/97944)

<div class="topic-metadata">

**Author:** [@aliyesami](https://discuss.elastic.co/u/aliyesami)\
**Replies:** 1\
**Last updated:** [August 22, 2017, 8:50pm UTC](https://discuss.elastic.co/t/elaspic-mapper-size-not-working/97944 "2017-08-22T20:50:38Z")

</div>

I have installed the mapper-size plugin on all cluster nodes and rebooted the server but still I cant modify the mapping , please advise . \[elasticsearch@hadoop1 bin\]$ ./elasticsearch-plugin install mapper-size -\> Do…

---

## [Stream data from Elastic search and store in Hadoop](https://discuss.elastic.co/t/stream-data-from-elastic-search-and-store-in-hadoop/97591)

<div class="topic-metadata">

**Author:** [@rrai](https://discuss.elastic.co/u/rrai)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 8:08pm UTC](https://discuss.elastic.co/t/stream-data-from-elastic-search-and-store-in-hadoop/97591 "2017-08-22T20:08:36Z")

</div>

I am reading data from elastic search through external table in hive. I want load data into HDFS from ES continuously instead of doing an external query in ES, and then fetch data into hive from HDFS. Ultimately, I want …

---

## [Problem reading environment variables when starting ES](https://discuss.elastic.co/t/problem-reading-environment-variables-when-starting-es/97973)

<div class="topic-metadata">

**Author:** [@bellinom](https://discuss.elastic.co/u/bellinom)\
**Replies:** 0\
**Last updated:** [August 22, 2017, 7:52pm UTC](https://discuss.elastic.co/t/problem-reading-environment-variables-when-starting-es/97973 "2017-08-22T19:52:26Z")

</div>

Hello, I am using the ES 5.5 reference guide to install ElasticSearch on RHEL 7. The issue I have is when I start the elasticsearch service it show success, but checking the service status shows failure. When I run the…

---

## [Using ElasticSearch to capture Syslogs (windows)](https://discuss.elastic.co/t/using-elasticsearch-to-capture-syslogs-windows/97963)

<div class="topic-metadata">

**Author:** [@blackmail242](https://discuss.elastic.co/u/blackmail242)\
**Replies:** 0\
**Last updated:** [August 22, 2017, 7:11pm UTC](https://discuss.elastic.co/t/using-elasticsearch-to-capture-syslogs-windows/97963 "2017-08-22T19:11:35Z")

</div>

Hello, I am relatively new to using ElasticSearch and the other products available here on Elastic. As mentioned above I am running a windows server and have installed Kibana, ElasticSearch, Beats, and (unsuccessfully) l…

---

## [Max number of indices](https://discuss.elastic.co/t/max-number-of-indices/97932)

<div class="topic-metadata">

**Author:** [@gchen](https://discuss.elastic.co/u/gchen)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 7:07pm UTC](https://discuss.elastic.co/t/max-number-of-indices/97932 "2017-08-22T19:07:40Z")

</div>

We’re heavily reliant on doc-types now, but i know doc-types is going away in 6.x. So i’m exploring idea of creating one index of each of the doc types. Would a few hundred indices cause problem? Around 500 indices? …

---

## [Search Indices based on time period](https://discuss.elastic.co/t/search-indices-based-on-time-period/97958)

<div class="topic-metadata">

**Author:** [@kvjeevan](https://discuss.elastic.co/u/kvjeevan)\
**Replies:** 0\
**Last updated:** [August 22, 2017, 6:58pm UTC](https://discuss.elastic.co/t/search-indices-based-on-time-period/97958 "2017-08-22T18:58:44Z")

</div>

Hi All, I am looking for some help on how to list the indices in elasticsearch based on the specified index creation time. for example, I want to know what are the indices created in one week period based on index creat…

---

## [Ignore\_above behavior](https://discuss.elastic.co/t/ignore-above-behavior/97445)

<div class="topic-metadata">

**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 6:58pm UTC](https://discuss.elastic.co/t/ignore-above-behavior/97445 "2017-08-22T18:58:11Z")

</div>

in the 2.3 documentation for ignore\_above, it says Strings longer than the ignore\_above setting will not be processed by the analyzer and will not be indexed. in the 5.0+ documentation, it says Strings longer than the i…

---

## [Analyzing High Elastic Search Response time](https://discuss.elastic.co/t/analyzing-high-elastic-search-response-time/97926)

<div class="topic-metadata">

**Author:** [@sss](https://discuss.elastic.co/u/sss)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 6:31pm UTC](https://discuss.elastic.co/t/analyzing-high-elastic-search-response-time/97926 "2017-08-22T18:31:54Z")

</div>

We have a setup of 2 index nodes. We have 3 indexes in the cluster with 1 shard each per index. The size of the index is around 11GB and we have around 86k documents in the index. Issue is that our search requests are…

---

## [How do i reindex data to resolve type conflict?](https://discuss.elastic.co/t/how-do-i-reindex-data-to-resolve-type-conflict/97448)

<div class="topic-metadata">

**Author:** [@nfplatzke](https://discuss.elastic.co/u/nfplatzke)\
**Replies:** 1\
**Last updated:** [August 17, 2017, 8:14pm UTC](https://discuss.elastic.co/t/how-do-i-reindex-data-to-resolve-type-conflict/97448 "2017-08-17T20:14:04Z")

</div>

Can someone provide a full concise example of how I would reindex my data to resolve a conflict? I have two fields where the type changed from string to integer. I don’t understand how the reindex process works or why I …

---

## [Unassigned dangling\_index\_imported](https://discuss.elastic.co/t/unassigned-dangling-index-imported/97922)

<div class="topic-metadata">

**Author:** [@vkatsikaros](https://discuss.elastic.co/u/vkatsikaros)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 5:13pm UTC](https://discuss.elastic.co/t/unassigned-dangling-index-imported/97922 "2017-08-22T17:13:13Z")

</div>

I have a cluster with status "red" $ curl -s http://127.0.0.1:9200/\_cluster/health | jq . { "active\_shards\_percent\_as\_number": 99.90479817212491, "task\_max\_waiting\_in\_queue\_millis": 0, "number\_of\_in\_flight\_fetch":…

---

## [Alias-level unique document id?](https://discuss.elastic.co/t/alias-level-unique-document-id/97950)

<div class="topic-metadata">

**Author:** [@Dan\_Markhasin](https://discuss.elastic.co/u/Dan_Markhasin)\
**Replies:** 0\
**Last updated:** [August 22, 2017, 5:08pm UTC](https://discuss.elastic.co/t/alias-level-unique-document-id/97950 "2017-08-22T17:08:54Z")

</div>

We are looking to migrate some of our business use cases from SQL Server to ElasticSearch and have come across a requirement to support merge-update functionality, i.e. create document if it doesn’t exist, otherwise over…

---

## [Elasticsearch join query](https://discuss.elastic.co/t/elasticsearch-join-query/97942)

<div class="topic-metadata">

**Author:** [@lask001](https://discuss.elastic.co/u/lask001)\
**Replies:** 0\
**Last updated:** [August 22, 2017, 4:32pm UTC](https://discuss.elastic.co/t/elasticsearch-join-query/97942 "2017-08-22T16:32:14Z")

</div>

I don’t think it’s possible to do what I’m trying to accomplish, but I thought I’d see if anyone has any ideas before I give up. Here are what my documents look like: "hits": { "total": 2, "max\_score": 10.277…

---

## [FInding insights in ES Data](https://discuss.elastic.co/t/finding-insights-in-es-data/97937)

<div class="topic-metadata">

**Author:** [@dcam](https://discuss.elastic.co/u/dcam)\
**Replies:** 1\
**Last updated:** [August 22, 2017, 4:22pm UTC](https://discuss.elastic.co/t/finding-insights-in-es-data/97937 "2017-08-22T16:22:54Z")

</div>

For us is difficult to figure out which Visualization we can create after data has been imported into ES. With ML we can see if there was any anomaly in our series data. Are there other Use Cases rather than Anomaly Det…

---

## [ES 2.4.6 works and 5.5.2 does not](https://discuss.elastic.co/t/es-2-4-6-works-and-5-5-2-does-not/97604)

<div class="topic-metadata">

**Author:** [@lee.moore](https://discuss.elastic.co/u/lee.moore)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 3:47pm UTC](https://discuss.elastic.co/t/es-2-4-6-works-and-5-5-2-does-not/97604 "2017-08-22T15:47:18Z")

</div>

I installed ES 2.4.6 for use with Chef. Shortly after, Chef updated compatibility to ES 5.x. Since we didn’t have any data in ES yet, I removed it via rpm -e and performed same install procedure for ES 5.5.2. After start…

---

## [Specifying default custom analyzer](https://discuss.elastic.co/t/specifying-default-custom-analyzer/97587)

<div class="topic-metadata">

**Author:** [@gchen](https://discuss.elastic.co/u/gchen)\
**Replies:** 1\
**Last updated:** [August 22, 2017, 2:58pm UTC](https://discuss.elastic.co/t/specifying-default-custom-analyzer/97587 "2017-08-22T14:58:11Z")

</div>

Hi, I’m working on upgrading out cluster to newer ES version. one of the template mapping that used to work on the old version doesn’t work on the newer version. I checked the document, there no mention that this beha…

---

## [Search multiple indexes with filter](https://discuss.elastic.co/t/search-multiple-indexes-with-filter/97930)

<div class="topic-metadata">

**Author:** [@David\_Pocivalnik](https://discuss.elastic.co/u/David_Pocivalnik)\
**Replies:** 0\
**Last updated:** [August 22, 2017, 2:47pm UTC](https://discuss.elastic.co/t/search-multiple-indexes-with-filter/97930 "2017-08-22T14:47:43Z")

</div>

Version of ES currently in use: 5.2 I’m trying to create a query, including filters, that runs against two indexes. Are there any preconditions , e.g. common fields, some kind of link between documents of a different i…

---

## [ES tests taking very long to execute (\> 1800s) on Windows 10](https://discuss.elastic.co/t/es-tests-taking-very-long-to-execute-1800s-on-windows-10/97929)

<div class="topic-metadata">

**Author:** [@saralor](https://discuss.elastic.co/u/saralor)\
**Replies:** 0\
**Last updated:** [August 22, 2017, 2:46pm UTC](https://discuss.elastic.co/t/es-tests-taking-very-long-to-execute-1800s-on-windows-10/97929 "2017-08-22T14:46:24Z")

</div>

I’ve forked the source code for ES to try and start playing with it. Before that, I’d like to verify that everything is at a stable point, so I’m running the tests with gradle check. The problem is that it always takes …

---

## [ES grok processor break\_on\_match =\> false needed](https://discuss.elastic.co/t/es-grok-processor-break-on-match-false-needed/96697)

<div class="topic-metadata">

**Author:** [@ffoysal](https://discuss.elastic.co/u/ffoysal)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 2:04pm UTC](https://discuss.elastic.co/t/es-grok-processor-break-on-match-false-needed/96697 "2017-08-22T14:04:13Z")

</div>

We have a pattern in logstash grok filter like this grok { break\_on\_match =\> false match =\> \[ “message”,".+mv=(?\<mediaVendor\>\[\\w\]+)\[\\s&\]+.+", “message”,".+mf=(?\<mediaFolder\>\[\\w\]+)\[\\s&\]+.+", “message”,".+cmd=(?\<c…

---

## [Range query blocks elasticsearch](https://discuss.elastic.co/t/range-query-blocks-elasticsearch/97293)

<div class="topic-metadata">

**Author:** [@Marco\_42](https://discuss.elastic.co/u/Marco_42)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 1:45pm UTC](https://discuss.elastic.co/t/range-query-blocks-elasticsearch/97293 "2017-08-22T13:45:35Z")

</div>

Hi everyone, I’m am almost a beginner in elasticsearch and I need a little help. I built a monitoring infrastructure with ELK for 60 nodes, with a single instance of all ELK stack with monitoring plugin on a single nod…

---

## [Migrating SOLR indexes into ElasticSearch](https://discuss.elastic.co/t/migrating-solr-indexes-into-elasticsearch/97620)

<div class="topic-metadata">

**Author:** [@krinker](https://discuss.elastic.co/u/krinker)\
**Replies:** 1\
**Last updated:** [August 22, 2017, 1:29pm UTC](https://discuss.elastic.co/t/migrating-solr-indexes-into-elasticsearch/97620 "2017-08-22T13:29:47Z")

</div>

We already have SOLR instance and we would like to migrate indexes that were already created into our ES instance. I see that river plug in was available, but was deprecated since then. Also, I would rather avoid to do i…

---

## [Wipe logs according to timestamp](https://discuss.elastic.co/t/wipe-logs-according-to-timestamp/97536)

<div class="topic-metadata">

**Author:** [@hun](https://discuss.elastic.co/u/hun)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 1:23pm UTC](https://discuss.elastic.co/t/wipe-logs-according-to-timestamp/97536 "2017-08-22T13:23:25Z")

</div>

Hi All, I have 2 elasticsearch nodes version 2.4.3 and I am trying to delete some logs that fall in a certain time range. When I search for the logs in the time range I specify, I get the following: { "took" : 174, …

---

## [External url for synonms\_path](https://discuss.elastic.co/t/external-url-for-synonms-path/97757)

<div class="topic-metadata">

**Author:** [@Vinothkumar](https://discuss.elastic.co/u/Vinothkumar)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 12:41pm UTC](https://discuss.elastic.co/t/external-url-for-synonms-path/97757 "2017-08-22T12:41:31Z")

</div>

Is there any possibilty to configure synonms\_path with external machine url. Sample Config "synonym" : { “type” : “synonym”, “synonyms\_path” : “http://domain:8080/esconfigdata/synonyms.txt”, “tokenizer” : “whitespac…

---

## [Need help with the below error](https://discuss.elastic.co/t/need-help-with-the-below-error/97838)

<div class="topic-metadata">

**Author:** [@Mohit\_Verma](https://discuss.elastic.co/u/Mohit_Verma)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 11:47am UTC](https://discuss.elastic.co/t/need-help-with-the-below-error/97838 "2017-08-22T11:47:33Z")

</div>

“error”:{“root\_cause”:\[{“type”:“parsing\_exception”,“reason”:“Unknown key for a START\_OBJECT in \[inline\].”,“line”:1,“col”:12}\],“type”:“parsing\_exception”,“reason”:“Unknown key for a START\_OBJECT in \[inline\].”,“line”:1,“co…

---

## [ES Aggregation (Bug?) - No buckets results at high "min\_doc\_count" and low "size"](https://discuss.elastic.co/t/es-aggregation-bug-no-buckets-results-at-high-min-doc-count-and-low-size/97891)

<div class="topic-metadata">

**Author:** [@Sinmson](https://discuss.elastic.co/u/Sinmson)\
**Replies:** 1\
**Last updated:** [August 22, 2017, 11:15am UTC](https://discuss.elastic.co/t/es-aggregation-bug-no-buckets-results-at-high-min-doc-count-and-low-size/97891 "2017-08-22T11:15:19Z")

</div>

Hey, I have 2 different types of documents. Request Response They share the same sessionid. As result I want the aggregated documened grouped by there sessionid. Thats what I did: aggregations by terms sorting by …

---

## [Ceil function on elasticsearch](https://discuss.elastic.co/t/ceil-function-on-elasticsearch/97893)

<div class="topic-metadata">

**Author:** [@Saurab\_Dahal](https://discuss.elastic.co/u/Saurab_Dahal)\
**Replies:** 0\
**Last updated:** [August 22, 2017, 10:59am UTC](https://discuss.elastic.co/t/ceil-function-on-elasticsearch/97893 "2017-08-22T10:59:32Z")

</div>

How can represent numbers like 0.00009 to 0.0001 instead or 0.29 to 0.3 ? Is it possible with elasticsearch?

---

## [Missing authentication token for REST request \[/\_bulk\]](https://discuss.elastic.co/t/missing-authentication-token-for-rest-request--bulk/97706)

<div class="topic-metadata">

**Author:** [@jefry\_he](https://discuss.elastic.co/u/jefry_he)\
**Replies:** 2\
**Last updated:** [August 22, 2017, 10:38am UTC](https://discuss.elastic.co/t/missing-authentication-token-for-rest-request--bulk/97706 "2017-08-22T10:38:10Z")

</div>

ES 5.5.2 error:missing authentication token for REST request \[/\_bulk\]

---

## [Elaticsearch Hadoop HDFS Snopshot](https://discuss.elastic.co/t/elaticsearch-hadoop-hdfs-snopshot/97890)

<div class="topic-metadata">

**Author:** [@Samy\_Nathan](https://discuss.elastic.co/u/Samy_Nathan)\
**Replies:** 0\
**Last updated:** [August 22, 2017, 10:37am UTC](https://discuss.elastic.co/t/elaticsearch-hadoop-hdfs-snopshot/97890 "2017-08-22T10:37:09Z")

</div>

Hi, iam trying to elasticsearch index take backup (snopshot) using Hadoop HDFS respository but showing following errors: elasticsearch version = 2.4.1 Appache hadoop version=2.7.1 Steps1 : install hdfs Repo plugin …

---

## [How to implement elastic search in asp.net with sql server](https://discuss.elastic.co/t/how-to-implement-elastic-search-in-asp-net-with-sql-server/97392)

<div class="topic-metadata">

**Author:** [@Nikunj113](https://discuss.elastic.co/u/Nikunj113)\
**Replies:** 4\
**Last updated:** [August 22, 2017, 10:13am UTC](https://discuss.elastic.co/t/how-to-implement-elastic-search-in-asp-net-with-sql-server/97392 "2017-08-22T10:13:20Z")

</div>

i have created website which is contain large amount of data and i have used asp.net with sql server to build the website , now i want to implement elastic search with sql server database .if anyone knows so please help…

---

## [Understanding snapshot while deleting documents](https://discuss.elastic.co/t/understanding-snapshot-while-deleting-documents/97889)

<div class="topic-metadata">

**Author:** [@elk\_user1](https://discuss.elastic.co/u/elk_user1)\
**Replies:** 0\
**Last updated:** [August 22, 2017, 10:09am UTC](https://discuss.elastic.co/t/understanding-snapshot-while-deleting-documents/97889 "2017-08-22T10:09:04Z")

</div>

Hi there, I am working on creating backup and deleting the corresponding data from my index, so as to have a backup and save disk space. Plan to do this on a daily or weekly basis. However, it seems the snapshots create…

---

## [\[5.3\] BulkProcessor never release semaphore (ByteBuffer OOME)](https://discuss.elastic.co/t/5-3-bulkprocessor-never-release-semaphore-bytebuffer-oome/97560)

<div class="topic-metadata">

**Author:** [@ebillaud](https://discuss.elastic.co/u/ebillaud)\
**Replies:** 1\
**Last updated:** [August 22, 2017, 9:53am UTC](https://discuss.elastic.co/t/5-3-bulkprocessor-never-release-semaphore-bytebuffer-oome/97560 "2017-08-22T09:53:20Z")

</div>

Problem Here is the problem observed : while doing bulk indexing, and after a while, the semaphore is acquired in the internalAdd method of the asynchronous bulk request handler, but is never released. After some invest…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1970)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=1972)
